Function get_pack_file_abs_path

st2common/st2common/content/utils.py:247–315

Retrieve full absolute path to the pack file. Note: This function also takes care of sanitizing ``file_name`` argument preventing directory traversal and similar attacks. :param pack_ref: Pack reference (needs to be the same as directory on disk). :type pack_ref: ``str``

(
    pack_ref, file_path, resource_type=None, use_pack_cache=False
)

def get_pack_file_abs_path(
    pack_ref, file_path, resource_type=None, use_pack_cache=False
):
    """
    Retrieve full absolute path to the pack file.

    Note: This function also takes care of sanitizing ``file_name`` argument
          preventing directory traversal and similar attacks.

    :param pack_ref: Pack reference (needs to be the same as directory on disk).
    :type pack_ref: ``str``

    :pack file_path: Resource file path relative to the pack directory (e.g. my_file.py or
                     actions/directory/my_file.py)
    :type file_path: ``str``

    param: resource_type: Optional resource type. If provided, more user-friendly exception
                          is thrown on error.
    :type resource_type: ``str``

    :rtype: ``str``
    """
    pack_base_path = get_pack_base_path(
        pack_name=pack_ref, use_pack_cache=use_pack_cache
    )

    if resource_type:
        resource_type_plural = " %ss " % (resource_type)
        resource_base_path = os.path.join(pack_base_path, "%ss/" % (resource_type))
    else:
        resource_type_plural = " "
        resource_base_path = pack_base_path

    path_components = []
    path_components.append(pack_base_path)

    # Normalize the path to prevent directory traversal
    normalized_file_path = os.path.normpath("/" + file_path).lstrip("/")

    if normalized_file_path != file_path:
        msg = INVALID_FILE_PATH_ERROR % (
            file_path,
            resource_type_plural,
            resource_base_path,
            resource_type or "action",
        )
        raise ValueError(msg)

    path_components.append(normalized_file_path)
    result = os.path.join(*path_components)  # pylint: disable=E1120

    if normalized_file_path not in result:
        raise ValueError(
            f"This is not a normalized path {normalized_file_path}"
            f" to prevent directory traversal {result}."
        )

    # Final safety check for common prefix to avoid traversal attack